Edit tour

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.arm7.elf

Overview

General Information

Sample name:	ub8ehJSePAfc9FYqZIT6.arm7.elf
Analysis ID:	1583850
MD5:	3850a6ed3b8397a787989e782dd8f96d
SHA1:	1b67ffbaecdc01a7a7305cbc19139bf230496506
SHA256:	fbf8b8524b49dbcb4369bc7f84cb321a01fbf956c3c4ea7475e7fcb813ba13cf
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Yara detected Mirai

Sample is packed with UPX

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Sample contains only a LOAD segment without any section mappings

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583850
Start date and time:	2025-01-03 18:36:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	ub8ehJSePAfc9FYqZIT6.arm7.elf
Detection:	MAL
Classification:	mal60.troj.evad.linELF@0/0@0/0

Warnings

VT rate limit hit for: ub8ehJSePAfc9FYqZIT6.arm7.elf

Runtime Messages

Command:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
PID:	5496
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496, Parent: 5418, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 5498, Parent: 5496)

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 5500, Parent: 5498)

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 5502, Parent: 5498)

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 5507, Parent: 5496)

ub8ehJSePAfc9FYqZIT6.arm7.elf New Fork (PID: 5509, Parent: 5496)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
5496.1.00007f6be0017000.00007f6be002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5496.1.00007f6be0017000.00007f6be002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5498.1.00007f6be0017000.00007f6be002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5498.1.00007f6be0017000.00007f6be002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5507.1.00007f6be0017000.00007f6be002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5507.1.00007f6be0017000.00007f6be002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
5500.1.00007f6be0017000.00007f6be002f000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5500.1.00007f6be0017000.00007f6be002f000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1542c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15440:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15454:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15468:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15490:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15508:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15530:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15544:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15558:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15580:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15594:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5496	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5496	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x743:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x757:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x76b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x77f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x793:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7a7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7bb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7cf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7f7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x80b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x81f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x833:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x847:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x85b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x86f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x883:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x897:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x8d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5498	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5498	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1306:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x131a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1342:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1356:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x136a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x137e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1392:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x13f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x140a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x141e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1432:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1446:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1482:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1496:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5500	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5500	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11a8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11aa2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ab6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11aca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ade:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11af2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b06:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b1a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b2e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b42:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b56:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b6a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b7e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b92:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ba6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11be2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11bf6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c0a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c1e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5507	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5507	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x153db:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x153ef:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15403:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15417:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1542b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1543f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15453:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15467:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1547b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1548f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154b7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154cb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154df:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154f3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15507:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1551b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1552f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15543:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15557:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1556b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: global traffic

TCP traffic: 192.168.2.13:44072 -> 141.11.33.73:3778

Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73
Source: unknown	TCP traffic detected without corresponding DNS query: 141.11.33.73

Source: ub8ehJSePAfc9FYqZIT6.arm7.elf

String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 5496.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5498.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5507.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 5500.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5496, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5498, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5500, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5507, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: LOAD without section mappings

Program segment: 0x8000

Source: 5496.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5498.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5507.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 5500.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5496, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5498, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5500, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5507, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal60.troj.evad.linELF@0/0@0/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.94 Copyright (C) 1996-2017 the UPX Team. All Rights Reserved. $

Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/230/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/110/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/231/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/111/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/232/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/112/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/233/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/113/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/234/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/114/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/235/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/115/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/236/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/116/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/237/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/117/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/238/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/118/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/239/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/119/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/3633/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/914/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/10/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/917/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/11/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/12/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/13/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/14/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/15/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/16/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/17/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/18/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/19/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/240/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/3095/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/120/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/241/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/121/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/242/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/1/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/122/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/243/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/2/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/123/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/244/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/3/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/124/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/245/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/1588/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/125/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/4/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/246/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/126/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/5/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/247/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/127/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/6/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/248/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/128/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/7/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/249/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/129/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/8/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/800/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/9/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/1906/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/802/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/3764/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/803/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/20/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/21/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/22/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/23/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/24/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/25/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/26/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/27/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/28/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/29/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/3420/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/1482/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/490/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/1480/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/250/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/371/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/130/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/251/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/131/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/252/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/132/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/253/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/254/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/1238/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/134/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/255/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/256/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/257/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/378/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/3413/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/258/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/259/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/1475/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/936/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/30/status	Jump to behavior
Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)	File opened: /proc/816/status	Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.arm7.elf

Submission file: segment LOAD with 7.9751 entropy (max. 8.0)

Source: /tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf (PID: 5496)

Queries kernel information via 'uname':

Jump to behavior

Source: ub8ehJSePAfc9FYqZIT6.arm7.elf, 5496.1.00007ffe06f9c000.00007ffe06fbd000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5498.1.00007ffe06f9c000.00007ffe06fbd000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5500.1.00007ffe06f9c000.00007ffe06fbd000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5507.1.00007ffe06f9c000.00007ffe06fbd000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Source: ub8ehJSePAfc9FYqZIT6.arm7.elf, 5496.1.000055e748972000.000055e748bc1000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5498.1.000055e748972000.000055e748ba0000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5500.1.000055e748972000.000055e748ba0000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5507.1.000055e748972000.000055e748bc1000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: ub8ehJSePAfc9FYqZIT6.arm7.elf, 5496.1.000055e748972000.000055e748bc1000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5498.1.000055e748972000.000055e748ba0000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5500.1.000055e748972000.000055e748ba0000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5507.1.000055e748972000.000055e748bc1000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: ub8ehJSePAfc9FYqZIT6.arm7.elf, 5496.1.00007ffe06f9c000.00007ffe06fbd000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5498.1.00007ffe06f9c000.00007ffe06fbd000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5500.1.00007ffe06f9c000.00007ffe06fbd000.rw-.sdmp, ub8ehJSePAfc9FYqZIT6.arm7.elf, 5507.1.00007ffe06f9c000.00007ffe06fbd000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 5496.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5498.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5507.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5500.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5498, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5507, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 5496.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5498.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5507.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5500.1.00007f6be0017000.00007f6be002f000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5498, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5500, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5507, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	11 Obfuscated Files or Information	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	ub8ehJSePAfc9FYqZIT6.arm7.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
141.11.33.73	unknown	United Kingdom		553	BELWUEBelWue-KoordinationEU	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
141.11.33.73	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.x86_64.elf	Get hash	malicious	Unknown	Browse
	ub8ehJSePAfc9FYqZIT6.arm.elf	Get hash	malicious	Mirai	Browse
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BELWUEBelWue-KoordinationEU	ub8ehJSePAfc9FYqZIT6.m68k.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	ub8ehJSePAfc9FYqZIT6.x86_64.elf	Get hash	malicious	Unknown	Browse	141.11.33.73
	ub8ehJSePAfc9FYqZIT6.arm.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	ub8ehJSePAfc9FYqZIT6.x86.elf	Get hash	malicious	Unknown	Browse	141.11.33.73
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	141.11.33.73-boatnet.arm-2025-01-03T05_39_17.elf	Get hash	malicious	Mirai	Browse	141.11.33.73
	Hilix.mips.elf	Get hash	malicious	Mirai	Browse	134.155.120.154
	armv5l.elf	Get hash	malicious	Unknown	Browse	141.79.218.248
	kwari.arm.elf	Get hash	malicious	Unknown	Browse	134.34.202.108

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.984844298036467
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	ub8ehJSePAfc9FYqZIT6.arm7.elf
File size:	61'840 bytes
MD5:	3850a6ed3b8397a787989e782dd8f96d
SHA1:	1b67ffbaecdc01a7a7305cbc19139bf230496506
SHA256:	fbf8b8524b49dbcb4369bc7f84cb321a01fbf956c3c4ea7475e7fcb813ba13cf
SHA512:	545b12f6ebfa4fb4b27658c497cf7e3f837935aec0de44b7e0466163994868c5e1df758bcf6e8c937d79b28d11795d6eec536a39c2a7c01c13a2f7efb4e39c8d
SSDEEP:	1536:Y7XduYshWhq/HIEy6Og3Nwz9hAyxP4fzLSM5Tfv83KJGTb6R4T:qdpssMPR9w4yxP4fzLXTX83K0Tb6Rg
TLSH:	2F530222880368B5EB63BE77BBF04FC3F50D8B7274A9A47920556158F6F946128313E7
File Content Preview:	.ELF..............(.....`...4...........4. ...(.....................M...M................6...6...6..................Q.td...............................OUPX!.........n...n......j..........?.E.h;....#..$...o....P.G.o.....X.*.V......f..T.qh...4.8........8.\|i

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x11c60
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8000	0x8000	0xae4d	0xae4d	7.9751	0x5	R E	0x8000
LOAD	0x36c8	0x236c8	0x236c8	0x0	0x0	0.0000	0x6	RW	0x8000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 3, 2025 18:37:15.773411036 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:15.778213978 CET	3778	44072	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:15.778268099 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:15.832238913 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:15.837114096 CET	3778	44072	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:15.837157965 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:15.841905117 CET	3778	44072	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:16.792211056 CET	3778	44072	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:16.792860031 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:16.792860031 CET	44072	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:16.793401003 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:16.798191071 CET	3778	44074	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:16.798297882 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:16.799062967 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:16.803823948 CET	3778	44074	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:16.803917885 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:16.808676958 CET	3778	44074	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:17.894674063 CET	3778	44074	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:17.894968033 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:17.894968033 CET	44074	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:17.895462036 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:17.900291920 CET	3778	44076	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:17.900343895 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:17.900909901 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:17.905703068 CET	3778	44076	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:17.905742884 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:17.910553932 CET	3778	44076	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:18.923548937 CET	3778	44076	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:18.923739910 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:18.923830032 CET	44076	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:18.924366951 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:18.929193020 CET	3778	44078	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:18.929378033 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:18.929925919 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:18.934757948 CET	3778	44078	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:18.934809923 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:18.939627886 CET	3778	44078	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:20.005273104 CET	3778	44078	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:20.005507946 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:20.005551100 CET	44078	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:20.006019115 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:20.010869980 CET	3778	44080	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:20.010950089 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:20.011584044 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:20.016411066 CET	3778	44080	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:20.016455889 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:20.021259069 CET	3778	44080	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:21.045644999 CET	3778	44080	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:21.045855999 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.045901060 CET	44080	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.046430111 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.051171064 CET	3778	44082	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:21.051212072 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.051964998 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.056756020 CET	3778	44082	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:21.056797981 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.061578989 CET	3778	44082	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:21.558162928 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.563085079 CET	3778	44084	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:21.563208103 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.615816116 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.620659113 CET	3778	44084	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:21.620707989 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:21.625524044 CET	3778	44084	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:22.072324991 CET	3778	44082	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:22.072428942 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:22.072468996 CET	44082	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:22.072979927 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:22.077812910 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:22.077857018 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:22.078596115 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:22.083381891 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:22.083431005 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:22.088175058 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:25.642404079 CET	3778	44084	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:25.642656088 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:25.642990112 CET	44084	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:25.643577099 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:25.648410082 CET	3778	44088	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:25.648463011 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:25.649616957 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:25.654424906 CET	3778	44088	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:25.654468060 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:25.659300089 CET	3778	44088	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:26.692967892 CET	3778	44088	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:26.693180084 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:26.693217039 CET	44088	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:26.693926096 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:26.698756933 CET	3778	44090	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:26.698826075 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:26.699659109 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:26.704453945 CET	3778	44090	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:26.704498053 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:26.709266901 CET	3778	44090	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:28.391881943 CET	3778	44090	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:28.392013073 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:28.392013073 CET	44090	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:28.392515898 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:28.397330999 CET	3778	44092	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:28.397376060 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:28.398029089 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:28.402941942 CET	3778	44092	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:28.402996063 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:28.407856941 CET	3778	44092	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:29.445383072 CET	3778	44092	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:29.445540905 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:29.445540905 CET	44092	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:29.446038961 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:29.450779915 CET	3778	44094	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:29.450856924 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:29.451555967 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:29.456377029 CET	3778	44094	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:29.456413984 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:29.461184025 CET	3778	44094	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:31.046421051 CET	3778	44094	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:31.046540976 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:31.046600103 CET	44094	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:31.047221899 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:31.052052975 CET	3778	44096	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:31.052107096 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:31.052875996 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:31.057621956 CET	3778	44096	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:31.057668924 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:31.062488079 CET	3778	44096	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:32.088711023 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:32.093637943 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:33.093684912 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:33.093867064 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:33.636832952 CET	3778	44096	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:33.637290001 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:33.637290001 CET	44096	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:33.638041973 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:33.643459082 CET	3778	44098	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:33.643507004 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:33.644617081 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:33.649555922 CET	3778	44098	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:33.649599075 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:33.654361010 CET	3778	44098	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:34.661225080 CET	3778	44098	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:34.661509991 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:34.661608934 CET	44098	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:34.662585020 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:34.667385101 CET	3778	44100	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:34.667516947 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:34.668678045 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:34.673403978 CET	3778	44100	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:34.673466921 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:34.678358078 CET	3778	44100	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:36.354033947 CET	3778	44100	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:36.354193926 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:36.354259014 CET	44100	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:36.355101109 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:36.359926939 CET	3778	44102	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:36.359972954 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:36.360831976 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:36.365593910 CET	3778	44102	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:36.365648031 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:36.370373964 CET	3778	44102	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:37.381108046 CET	3778	44102	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:37.381237030 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:37.381333113 CET	44102	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:37.382132053 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:37.386980057 CET	3778	44104	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:37.387057066 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:37.388075113 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:37.392826080 CET	3778	44104	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:37.392880917 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:37.397716045 CET	3778	44104	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:38.394937038 CET	3778	44104	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:38.395046949 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:38.395087957 CET	44104	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:38.395632029 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:38.400463104 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:38.400544882 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:38.401259899 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:38.405999899 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:38.406061888 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:38.410828114 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:43.136217117 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:43.136526108 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:43.136581898 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:43.137496948 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:43.289031982 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:43.289041996 CET	3778	44106	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:43.289176941 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:43.289176941 CET	44106	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:43.289485931 CET	3778	44108	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:43.289597034 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:43.291157961 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:43.295960903 CET	3778	44108	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:43.296010017 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:43.300947905 CET	3778	44108	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:44.300812960 CET	3778	44108	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:44.301156044 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:44.301198006 CET	44108	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:44.302078962 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:44.306823015 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:44.306948900 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:44.308043003 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:44.312880039 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:44.312988043 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:44.317758083 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:37:54.317454100 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:37:54.322267056 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:05.661112070 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:05.661621094 CET	44110	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:05.666471004 CET	3778	44110	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:06.664324999 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:06.669461966 CET	3778	44112	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:06.669562101 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:06.670799017 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:06.675563097 CET	3778	44112	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:06.675637007 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:06.680454969 CET	3778	44112	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:17.296526909 CET	3778	44112	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:17.296907902 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:17.296907902 CET	44112	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:17.297570944 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:17.302354097 CET	3778	44114	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:17.302405119 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:17.303262949 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:17.308002949 CET	3778	44114	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:17.308046103 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:17.312772989 CET	3778	44114	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:21.354127884 CET	3778	44114	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:21.354252100 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:21.354288101 CET	44114	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:21.355000973 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:21.359846115 CET	3778	44116	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:21.359957933 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:21.361124992 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:21.365860939 CET	3778	44116	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:21.365930080 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:21.370727062 CET	3778	44116	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:22.403592110 CET	3778	44116	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:22.403866053 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:22.403867006 CET	44116	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:22.404520035 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:22.410264015 CET	3778	44118	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:22.410321951 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:22.411237001 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:22.416528940 CET	3778	44118	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:22.416565895 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:22.421514988 CET	3778	44118	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:23.433015108 CET	3778	44118	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:23.433173895 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:23.433362961 CET	44118	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:23.434122086 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:23.438899040 CET	3778	44120	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:23.438998938 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:23.439964056 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:23.444713116 CET	3778	44120	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:23.444785118 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:23.449565887 CET	3778	44120	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:24.510871887 CET	3778	44120	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:24.510986090 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:24.511346102 CET	44120	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:24.511929035 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:24.516712904 CET	3778	44122	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:24.516791105 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:24.517700911 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:24.522463083 CET	3778	44122	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:24.522540092 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:24.527287960 CET	3778	44122	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:25.556525946 CET	3778	44122	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:25.556679010 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:25.556782007 CET	44122	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:25.557630062 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:25.562510967 CET	3778	44124	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:25.562606096 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:25.563616991 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:25.568404913 CET	3778	44124	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:25.568470001 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:25.573328972 CET	3778	44124	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:27.234776020 CET	3778	44124	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:27.234951973 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:27.235147953 CET	44124	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:27.235869884 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:27.240684986 CET	3778	44126	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:27.240789890 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:27.241764069 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:27.246644974 CET	3778	44126	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:27.246731043 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:27.251650095 CET	3778	44126	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:33.141252995 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:38:33.146229029 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:34.142415047 CET	3778	44086	141.11.33.73	192.168.2.13
Jan 3, 2025 18:38:34.142652988 CET	44086	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:39:07.276796103 CET	44126	3778	192.168.2.13	141.11.33.73
Jan 3, 2025 18:39:07.281589031 CET	3778	44126	141.11.33.73	192.168.2.13
Jan 3, 2025 18:39:07.656452894 CET	3778	44126	141.11.33.73	192.168.2.13
Jan 3, 2025 18:39:07.656570911 CET	44126	3778	192.168.2.13	141.11.33.73

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5496, Parent PID: 5418

General

Start time (UTC):	17:37:14
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5498, Parent PID: 5496

General

Start time (UTC):	17:37:14
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5500, Parent PID: 5498

General

Start time (UTC):	17:37:14
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5502, Parent PID: 5498

General

Start time (UTC):	17:37:14
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5507, Parent PID: 5496

General

Start time (UTC):	17:37:20
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5509, Parent PID: 5496

General

Start time (UTC):	17:37:20
Start date (UTC):	03/01/2025
Path:	/tmp/ub8ehJSePAfc9FYqZIT6.arm7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ub8ehJSePAfc9FYqZIT6.arm7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5496, Parent PID: 5418

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5498, Parent PID: 5496

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5500, Parent PID: 5498

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5502, Parent PID: 5498

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5507, Parent PID: 5496

General

Chronological Activities

Analysis Process: ub8ehJSePAfc9FYqZIT6.arm7.elf PID: 5509, Parent PID: 5496

General

Chronological Activities

Linux Analysis Report
ub8ehJSePAfc9FYqZIT6.arm7.elf